(a) Except as otherwise provided by this chapter or other law, a direct-to-consumer genetic testing company that possesses an individual's deidentified data shall:
(1) implement administrative and technical measures to ensure the data is not associated with a particular individual; and
(2) publicly commit to maintaining and using data in deidentified form and refraining from making any attempt to identify an individual using the individual's deidentified data.
(b) If a direct-to-consumer genetic testing company shares an individual's deidentified data with another person, the company shall enter into a legally enforceable contractual obligation prohibiting the person from attempting to identify an individual using the individual's deidentified data.